/mandos/trunk : revision 1213

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to dracut-module/password-agent.c

Committer: teddy at recompile
Date: 2020-04-05 21:30:59 UTC
Revision ID: teddy@recompile.se-20200405213059-fb2a61ckqynrmatk

Fix file descriptor leak in mandos-client

When the local network has Mandos servers announcing themselves using
real, globally reachable, IPv6 addresses (i.e. not link-local
addresses), but there is no router on the local network providing IPv6
RA (Router Advertisement) packets, the client cannot reach the server
by normal means, since the client only has a link-local IPv6 address,
and has no usable route to reach the server's global IPv6 address.
(This is not a common situation, and usually only happens when the
router itself reboots and runs a Mandos client, since it cannot then
give RA packets to itself.)  The client code has a solution for
this, which consists of adding a temporary local route to reach the
address of the server during communication, and removing this
temporary route afterwards.

This solution with a temporary route works, but has a file descriptor
leak; it leaks one file descriptor for each addition and for each
removal of a route.  If one server requiring an added route is present
on the network, but no servers gives a password, making the client
retry after the default ten seconds, and we furthermore assume a
default 1024 open files limit, the client runs out of file descriptors
after about 90 minutes, after which time the client process will be
useless and fail to retrieve any passwords, necessitating manual
password entry via the keyboard.

Fix this by eliminating the file descriptor leak in the client.

* plugins.d/mandos-client.c (add_delete_local_route): Do
  close(devnull) also in parent process, also if fork() fails, and on
  any failure in child process.

Show diffs side-by-side

added added

removed removed

dracut-module/password-agent.c

#include <sysexits.h> /* EX_USAGE, EX_OSERR, EX_OSFILE */

#include <errno.h> /* errno, error_t, EACCES,

ENAMETOOLONG, ENOENT, ENOTDIR,

EEXIST, ECHILD, EPERM, ENOMEM,

ENOMEM, EEXIST, ECHILD, EPERM,

EAGAIN, EINTR, ENOBUFS, EADDRINUSE,

ECONNREFUSED, ECONNRESET,

ETOOMANYREFS, EMSGSIZE, EBADF,

ARGP_ERR_UNKNOWN, ARGP_KEY_ARGS,

struct argp, argp_parse(),

ARGP_NO_EXIT */

#include <stdint.h> /* SIZE_MAX */

#include <unistd.h> /* uid_t, gid_t, close(), pipe2(),

fork(), _exit(), dup2(),

STDOUT_FILENO, setresgid(),

IN_EXCL_UNLINK, IN_ONLYDIR,

struct inotify_event */

#include <fnmatch.h> /* fnmatch(), FNM_FILE_NAME */

#include <stdio.h> /* asprintf(), FILE, fopen(),

getline(), sscanf(), feof(),

100

ferror(), fclose(), stderr,

101

rename(), fdopen(), fprintf(),

102

fscanf() */

#include <stdio.h> /* asprintf(), FILE, stderr, fopen(),

100

fclose(), getline(), sscanf(),

101

feof(), ferror(), rename(),

102

fdopen(), fprintf(), fscanf() */

103

#include <glib.h> /* GKeyFile, g_key_file_free(), g_key_file_new(),

104

GError, g_key_file_load_from_file(),

105

G_KEY_FILE_NONE, TRUE, G_FILE_ERROR_NOENT,

651

652

__attribute__((nonnull, warn_unused_result))

653

bool add_to_queue(task_queue *const queue, const task_context task){

654

if((queue->length + 1) > (SIZE_MAX / sizeof(task_context))){

655

/* overflow */

656

error(0, ENOMEM, "Failed to allocate %" PRIuMAX

657

" tasks for queue->tasks", (uintmax_t)(queue->length + 1));

658

errno = ENOMEM;

659

return false;

660

}

654

661

const size_t needed_size = sizeof(task_context)*(queue->length + 1);

655

662

if(needed_size > (queue->allocated)){

656

663

task_context *const new_tasks = realloc(queue->tasks,

861

868

}

862

869

close(pipefds[1]);

863

870

871

if(pid == -1){

872

error(0, errno, "Failed to fork()");

873

close(pipefds[0]);

874

return false;

875

}

876

864

877

if(not add_to_queue(queue, (task_context){

865

878

.func=wait_for_mandos_client_exit,

866

879

.pid=pid,

1884

1897

g_assert_true(queue->tasks[0].func == dummy_func);

1885

1898

}

1886

1899

1900

static void test_add_to_queue_overflow(__attribute__((unused))

1901

test_fixture *fixture,

1902

__attribute__((unused))

1903

gconstpointer user_data){

1904

__attribute__((cleanup(cleanup_queue)))

1905

task_queue *queue = create_queue();

1906

g_assert_nonnull(queue);

1907

g_assert_true(queue->length == 0);

1908

queue->length = SIZE_MAX / sizeof(task_context); /* fake max size */

1909

1910

FILE *real_stderr = stderr;

1911

FILE *devnull = fopen("/dev/null", "we");

1912

g_assert_nonnull(devnull);

1913

stderr = devnull;

1914

const bool ret = add_to_queue(queue,

1915

(task_context){ .func=dummy_func });

1916

g_assert_true(errno == ENOMEM);

1917

g_assert_false(ret);

1918

stderr = real_stderr;

1919

g_assert_cmpint(fclose(devnull), ==, 0);

1920

queue->length = 0; /* Restore real size */

1921

}

1922

1887

1923

static void dummy_func(__attribute__((unused))

1888

1924

const task_context task,

1889

1925

__attribute__((unused))

2160

2196

}

2161

2197

exit(EXIT_SUCCESS);

2162

2198

}

2199

if(pid == -1){

2200

error(EXIT_FAILURE, errno, "Failed to fork()");

2201

}

2202

2163

2203

int status;

2164

2204

waitpid(pid, &status, 0);

2165

2205

if(WIFEXITED(status) and (WEXITSTATUS(status) == EXIT_SUCCESS)){

5918

5958

test_fixture *fixture,

5919

5959

__attribute__((unused))

5920

5960

gconstpointer user_data){

5961

#ifndef __amd64__

5962

g_test_skip("Skipping EMSGSIZE test on non-AMD64 platform");

5963

#else

5921

5964

__attribute__((cleanup(cleanup_close)))

5922

5965

const int epoll_fd = epoll_create1(EPOLL_CLOEXEC);

5923

5966

g_assert_cmpint(epoll_fd, >=, 0);

5976

6019

g_assert_cmpuint((unsigned int)queue->length, ==, 0);

5977

6020

g_assert_true(string_set_contains(cancelled_filenames,

5978

6021

question_filename));

6022

#endif

5979

6023

}

5980

6024

5981

6025

static void test_send_password_to_socket_retry(__attribute__((unused))

7862

7906

test_add("/parse_arguments/mixed", test_parse_arguments_mixed);

7863

7907

test_add("/queue/create", test_create_queue);

7864

7908

test_add("/queue/add", test_add_to_queue);

7909

test_add("/queue/add/overflow", test_add_to_queue_overflow);

7865

7910

test_add("/queue/has_question/empty",

7866

7911

test_queue_has_question_empty);

7867

7912

test_add("/queue/has_question/false",

8092

8137

g_option_context_set_help_enabled(context, FALSE);

8093

8138

g_option_context_set_ignore_unknown_options(context, TRUE);

8094

8139

8095

gboolean run_tests = FALSE;

8140

gboolean should_run_tests = FALSE;

8096

8141

GOptionEntry entries[] = {

8097

8142

{ "test", 0, 0, G_OPTION_ARG_NONE,

8098

&run_tests, "Run tests", NULL },

8143

&should_run_tests, "Run tests", NULL },

8099

8144

{ NULL }

8100

8145

};

8101

8146

g_option_context_add_main_entries(context, entries, NULL);

8108

8153

}

8109

8154

8110

8155

g_option_context_free(context);

8111

return run_tests != FALSE;

8156

return should_run_tests != FALSE;

8112

8157

}

Older »